libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
None
No privileges needed
User Interaction
Passive
Minimal interaction
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
References 5
https://github.com/sezero/mikmod
disclosure@vulncheck.com
https://github.com/sezero/mikmod/blob/libmikmod-3.3.13/libmikmod/loaders/load_i…
disclosure@vulncheck.com
https://github.com/sezero/mikmod/blob/libmikmod-3.3.14/libmikmod/NEWS
disclosure@vulncheck.com
https://github.com/sezero/mikmod/commit/e7c6c9e88fbe3e8af4668a2e116bb8de341383f8
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/libmikmod-before-3.3.14-heap-out-of-bounds…
disclosure@vulncheck.com